Implementing Device Cookie-Based Rate Limiting in Django

Based on your exploration of device cookie-based rate limiting for Django's authentication system, I can provide some insights on potential implementation approaches.

Customizing AuthenticationForm

The AuthenticationForm is a logical place to implement rate limiting logic since it already handles authentication validation. You could extend it to include device cookie checking:

PYTHONCopied
from django.contrib.auth.forms import AuthenticationForm
from django.core.exceptions import ValidationError

class RateLimitedAuthenticationForm(AuthenticationForm):
    def confirm_login_allowed(self, user):
        # Call parent method first to handle is_active check
        super().confirm_login_allowed(user)
        
        # Get or create device cookie from request
        device_id = self.request.COOKIES.get('device_id')
        
        # Check if this device is locked out
        if device_id and is_device_locked_out(device_id):
            raise ValidationError(
                "This device has been temporarily locked due to too many failed login attempts.",
                code="device_locked",
            )

Customizing LoginView

To set cookies in the response, you would need to customize the LoginView:

PYTHONCopied
from django.contrib.auth.views import LoginView
import uuid

class RateLimitedLoginView(LoginView):
    authentication_form = RateLimitedAuthenticationForm
    
    def form_invalid(self, form):
        # Set or update device cookie on failed login
        response = super().form_invalid(form)
        
        # If no device cookie exists, create one
        if not self.request.COOKIES.get('device_id'):
            device_id = str(uuid.uuid4())
            response.set_cookie('device_id', device_id, max_age=60*60*24*365, httponly=True, samesite='Lax')
            
        # Record failed login attempt for this device
        device_id = self.request.COOKIES.get('device_id')
        if device_id:
            record_failed_attempt(device_id, form.get_user())
            
        return response

Integration with PasswordResetConfirmView

For the password reset flow, you would need to modify the PasswordResetConfirmView to unlock devices:

PYTHONCopied
from django.contrib.auth.views import PasswordResetConfirmView

class UnlockingPasswordResetConfirmView(PasswordResetConfirmView):
    def form_valid(self, form):
        response = super().form_valid(form)
        
        # Unlock any devices locked for this user
        user = form.user
        unlock_devices_for_user(user)
        
        return response

Implementation Considerations

Based on your exploration, here are some thoughts on your specific questions:

1. Overriding Forms and Views: This is a valid approach and aligns with Django's extension patterns. The challenge is ensuring all entry points to authentication are covered.

2. New Models: Adding models for tracking failed logins and lockouts makes sense for persistence, but consider:

   • Could you use Django's cache framework instead for temporary lockouts?
   • If using models, ensure they have appropriate TTLs or cleanup mechanisms

3. Integration Options:

   • A contrib.auth.ratelimit sub-app could be a clean solution if added to Django core
   • For a third-party package, consider a middleware-based approach that wraps the authentication views

4. Alternative Implementation:

   • Instead of full models, you could use Django's cache framework with a custom backend for admin visibility
   • Consider a decorator-based approach that could be applied to any view that needs rate limiting

Streamlining the Approach

If you're aiming for Django core integration, I'd recommend:

1. Implement the core functionality in AuthenticationForm.confirm_login_allowed()
2. Add a response middleware that sets device cookies when needed
3. Use Django's cache framework for tracking attempts rather than full models
4. Add hooks in the password reset flow to clear lockouts

This would minimize the changes needed while providing the security benefits of device cookie-based rate limiting.

Would you like me to elaborate on any specific aspect of this implementation approach?